de lista de materiales de software (SBOM)

Blacklock is CREST-certified and ISO 27001:2022 compliant. Our penetration testers hold industry-recognised certifications including CREST CRT, CPSA, CISSP, OSCP, OSWE, OSCE, and CEH.

Blacklock's testing methodologies and reporting directly support MAS TRM Guidelines (mandatory for all MAS-regulated financial institutions), PDPA (which expects reasonable security arrangements, including regular testing), PCI DSS, ISO 27001, SOC 2, and GDPR. Each engagement produces three tailored reports—Executive, Developer, and Full Penetration Test—designed to satisfy auditors, regulators, and your internal security team.

Traditional penetration testing delivers a point-in-time snapshot. The report is valid on the day it is issued, but your security posture changes with every deployment. Penetration testing as a service provides continuous scanning before and after each manual test, AI-driven retesting when fixes are deployed, and a live dashboard showing your current vulnerability status—not last quarter's. This model is specifically suited to MAS TRM's expectation of ongoing vulnerability management and the PDPA's requirement for up-to-date security measures.

Blacklock covers web applications (authenticated and unauthenticated), REST APIs, external and internal infrastructure, cloud-hosted environments, and software supply chains via SBOM scanning. Testing can be scoped to match your regulatory obligations, such as internet-facing systems for MAS TRM compliance, or personal-data-handling systems for PDPA.

Duration depends on the size and complexity of the target. A standard web application test typically takes between one day and two weeks. Infrastructure engagements may vary based on the number of hosts and network complexity. Vulnerability scanning runs continuously regardless of whether a manual test is in progress.

Absolutely. Many Singapore customers begin with our vulnerability scanning subscription to establish continuous visibility, then add manual penetration testing to meet compliance requirements or security maturity demands. The platform supports this land-and-expand approach by design. All services share one dashboard, one set of integrations, and unified reporting.

Yes. API penetration testing is included as part of web application penetration testing, since modern application functionality is predominantly served via API endpoints. Our testers assess REST API authentication, authorisation, input validation, rate limiting, and data exposure, which is critical for fintech, SaaS, and any organisation where APIs handle sensitive data or financial transactions.